Privacy Policy and Personal Data Notice
Published UpdatedLast updated: 13 October 2026
Who is responsible for your information?
DoInIstanbul is operated by LAWFULL YAZILIM SANAYI VE TICARET LTD. STI., the controller responsible for the processing described here.
Address: UCEVLER MAH. IZMIR YOLU CAD. WESTPOINT D BLOK. NO:241 D IC KAPI: 118 BURSA/NILUFER — Bursa, Türkiye.
Contact: info@doinistanbul.com.
This notice covers doinistanbul.com. It explains how we handle information when you read our guides, contact us, choose cookie settings or allow website measurement.
Information, purposes and legal grounds
| Activity | Information involved | Purpose and basis under Turkish Law No. 6698 |
|---|---|---|
| Website delivery and security | IP address, request time, requested page, browser information and technical error/security records | Deliver the website and investigate faults or misuse; legitimate interests under Article 5(2)(f), subject to protecting your fundamental rights |
| Correspondence | Your email address, name if supplied, message and relevant attachments | Answer your question or correction; legitimate interests under Article 5(2)(f). Where necessary for a contract you request, Article 5(2)(c); where necessary to establish, exercise or protect a right, Article 5(2)(e) |
| Cookie preferences | Consent choice, time and notice version, and identifiers necessary to remember or demonstrate that choice | Apply your choice and meet relevant compliance duties; Article 5(2)(ç), where a legal obligation applies |
| Seasonal appearance | A browser-session cookie containing a season name | Remember the seasonal appearance; applicable processing basis and preference-cookie treatment: legitimate interests under Article 5(2)(f), subject to protecting your fundamental rights; optional storage is used only where a valid cookie exemption or your consent applies |
| Google Analytics 4 | Browser identifiers, visited pages, interaction events, referral information, device/browser information and approximate location information | Understand which guides are useful and improve navigation; your explicit consent under Article 5(1) |
| Microsoft Clarity | Browser identifiers, visited pages, clicks, scrolling, pointer movements, device/browser information and a reconstruction of interactions with the page | Find usability problems through heatmaps and session replays; your explicit consent under Article 5(1) |
Information is collected electronically through website requests, permitted measurement technologies, your cookie choices and messages you send. We do not require optional measurement to let you read our guides. Avoid sending passport copies, payment details, health information or other sensitive information to our general contact address.
Google Analytics and Microsoft Clarity
Google Analytics provides reports about visits and interactions. Clarity provides heatmaps and session replays: a reconstruction of how someone interacted with our website, rather than a recording from their camera or microphone. Both can involve identifiers and personal data; we do not describe them as completely anonymous.
Each tool starts only after you enable its category in Cookie settings. We configure measurement to exclude personal contact details and sensitive fields. Clarity page content is masked and sensitive areas are excluded from recording. You can refuse either tool, keep both disabled or withdraw your choice later. Withdrawal stops future processing based on that consent; it does not undo earlier lawful processing.
Recipients and external websites
Our hosting and email service providers process technical records and correspondence as necessary to provide their services: Hosting.com.tr (website hosting) and Promail (email hosting). Google receives Analytics data when you enable visitor statistics; Microsoft receives Clarity data when you enable heatmaps and session replay. Their respective service terms and privacy information explain any processing they perform for their own purposes.
If you activate an external map, its provider may receive your IP address, browser information and map requests. Relevant map providers and processing locations: OpenStreetMap map-tile services; external Google Maps links open only when followed. If you follow a link to a booking website, social network or messaging service, that service's privacy notice applies to information it collects. We may disclose relevant information to competent authorities when legally required.
Istanbul On Boat and RideInIstanbul are sister brands. Their booking sites handle their own reservation, payment and confirmation processes. Following a link does not mean you have submitted a booking to DoInIstanbul.
International processing
Google, Microsoft and other service providers may process information outside Türkiye. Applicable recipients, locations and the safeguards used for these transfers: Transfers requiring safeguards under Article 9 of Turkish Law No. 6698 must not start until an applicable adequacy decision or a valid statutory safeguard, such as an applicable standard contract, is in place. Provider terms alone are not described as proof that this requirement has been met. Contact us for details of the recipients, processing locations and safeguards applicable to your data. You can contact us for information about the safeguards applicable to your data. Permission for analytics is separate from the legal requirements for international transfers.
Retention
Our retention policy sets the following maximum periods: technical logs, 90 days; correspondence, two years after the last correspondence; consent evidence, three years after expiry or withdrawal of the relevant consent; rotating backups, 30 days. Data is deleted earlier when it is no longer needed. Records required for a legal obligation or a dispute may be retained for the relevant period and restricted to that purpose.
GA4 user/event data retention is set to two months; this setting does not define the retention of all aggregated reports. Clarity's published retention is 30 days for ordinary playback data and nine months for heatmap/click data and labelled or favourited sessions. Cookie lifetimes are listed separately in our Cookie Policy.
Your rights and requests
Under Turkish Law No. 6698, you can ask whether your data is processed, obtain information about the processing and its purpose, learn the recipients, request correction or deletion where the legal conditions are met, request notification of those actions to recipients, object to an adverse result produced exclusively by automated analysis, and seek compensation for unlawful processing.
Contact info@doinistanbul.com for help. Formal applications can also be sent in writing to the address above or through the methods accepted by the applicable Turkish application rules. We may request proportionate information to verify your identity. We respond to valid Turkish-law requests as soon as possible and within 30 days. You may complain to the Turkish Personal Data Protection Authority subject to the applicable procedure.
Where GDPR or another applicable privacy law gives you additional rights, these may include access, portability, restriction, objection and a complaint to your competent supervisory authority. We handle those requests under the law and deadlines that apply to you.
Security and changes
No internet service can guarantee absolute security. Report suspected disclosure or a website security problem to our contact address. We update this notice when our processing changes and display the effective date. A notice update does not by itself give permission for a new consent-based purpose.